13 years ago[IPSEC]: output mode to take an xfrm state as input param
Jamal Hadi Salim [Fri, 1 Sep 2006 00:42:59 +0000]
[IPSEC]: output mode to take an xfrm state as input param

Expose IPSEC modes output path to take an xfrm state as input param.
This makes it consistent with the input mode processing (which already
takes the xfrm state as a param).

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET]: Fix sk->sk_filter field access
Dmitry Mishin [Thu, 31 Aug 2006 22:28:39 +0000]
[NET]: Fix sk->sk_filter field access

Function sk_filter() is called from tcp_v{4,6}_rcv() functions with arg
needlock = 0, while socket is not locked at that moment. In order to avoid
this and similar issues in the future, use rcu for sk->sk_filter field read
protection.

Signed-off-by: Dmitry Mishin <dim@openvz.org>
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>

13 years ago[IPV6] MIP6: Fix to update IP6CB when cloned skbuff is received at HAO.
Masahide NAKAMURA [Thu, 31 Aug 2006 22:18:49 +0000]
[IPV6] MIP6: Fix to update IP6CB when cloned skbuff is received at HAO.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] STATE: Fix flusing with hash mask.
Masahide NAKAMURA [Thu, 31 Aug 2006 22:14:32 +0000]
[XFRM] STATE: Fix flusing with hash mask.

This is a minor fix about transformation state flushing
for net-2.6.19. Please apply it.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[TCP]: Fix rcv mss estimate for LRO
Herbert Xu [Thu, 31 Aug 2006 22:11:02 +0000]
[TCP]: Fix rcv mss estimate for LRO

By passing a Linux-generated TSO packet straight back into Linux, Xen
becomes our first LRO user :) Unfortunately, there is at least one spot
in our stack that needs to be changed to cope with this.

The receive MSS estimate is computed from the raw packet size.  This is
broken if the packet is GSO/LRO.  Fortunately the real MSS can be found
in gso_size so we simply need to use that if it is non-zero.

Real LRO NICs should of course set the gso_size field in future.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[RTNETLINK]: Fix typo causing wrong skb to be freed
Thomas Graf [Thu, 31 Aug 2006 22:04:30 +0000]
[RTNETLINK]: Fix typo causing wrong skb to be freed

A typo introduced by myself which leads to freeing the skb
containing the netlink message when it should free the newly
allocated skb for the reply.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[AF_UNIX]: Change max_dgram_qlen sysctl to __read_mostly
Brian Haley [Thu, 31 Aug 2006 22:03:36 +0000]
[AF_UNIX]: Change max_dgram_qlen sysctl to __read_mostly

Signed-off-by: Brian Haley <brian.haley@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET]: Change somaxconn sysctl to __read_mostly
Brian Haley [Thu, 31 Aug 2006 22:03:02 +0000]
[NET]: Change somaxconn sysctl to __read_mostly

Signed-off-by: Brian Haley <brian.haley@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[PKT_SCHED] act_simple.c: make struct simp_hash_info static
Adrian Bunk [Wed, 30 Aug 2006 22:03:07 +0000]
[PKT_SCHED] act_simple.c: make struct simp_hash_info static

This patch makes the needlessly global struct simp_hash_info static.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: add some missing #includes to various header files
Paul Moore [Wed, 30 Aug 2006 00:56:04 +0000]
[NetLabel]: add some missing #includes to various header files

Add some missing include files to the NetLabel related header files.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: uninline selinux_netlbl_inode_permission()
Paul Moore [Wed, 30 Aug 2006 00:55:38 +0000]
[NetLabel]: uninline selinux_netlbl_inode_permission()

Uninline the selinux_netlbl_inode_permission() at the request of
Andrew Morton.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: Cleanup ebitmap_import()
Paul Moore [Wed, 30 Aug 2006 00:55:11 +0000]
[NetLabel]: Cleanup ebitmap_import()

Rewrite ebitmap_import() so it is a bit cleaner and easier to read.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: Comment corrections.
Paul Moore [Wed, 30 Aug 2006 00:54:41 +0000]
[NetLabel]: Comment corrections.

Fix some incorrect comments.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: remove unused function prototypes
Paul Moore [Wed, 30 Aug 2006 00:54:17 +0000]
[NetLabel]: remove unused function prototypes

Removed some older function prototypes for functions that no longer exist.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NetLabel]: Correctly initialize the NetLabel fields.
Paul Moore [Wed, 30 Aug 2006 00:53:48 +0000]
[NetLabel]: Correctly initialize the NetLabel fields.

Fix a problem where the NetLabel specific fields of the sk_security_struct
structure were not being initialized early enough in some cases.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[DCCP]: Tidyup CCID3 list handling
Ian McDonald [Wed, 30 Aug 2006 00:50:19 +0000]
[DCCP]: Tidyup CCID3 list handling

As Arnaldo Carvalho de Melo points out I should be using list_entry in case
the structure changes in future. Current code functions but is reliant
on position and requires type cast.

Noticed when doing this that I have one more variable than I needed so
removing that also.

Signed off by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER] bridge: debug message fixes
Stephen Hemminger [Wed, 30 Aug 2006 00:49:31 +0000]
[NETFILTER] bridge: debug message fixes

If CONFIG_NETFILTER_DEBUG is enabled, it shouldn't change the
actions of the filtering. The message about skb->dst being NULL
is commonly triggered by dhclient, so it is useless. Make sure all
messages end in newline.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER] bridge: simplify nf_bridge_pad
Stephen Hemminger [Wed, 30 Aug 2006 00:48:57 +0000]
[NETFILTER] bridge: simplify nf_bridge_pad

Do some simple optimization on the nf_bridge_pad() function
and don't use magic constants. Eliminate a double call and
the #ifdef'd code for CONFIG_BRIDGE_NETFILTER.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER] bridge: code rearrangement for clarity
Stephen Hemminger [Wed, 30 Aug 2006 00:48:17 +0000]
[NETFILTER] bridge: code rearrangement for clarity

Cleanup and rearrangement for better style and clarity:
Split the function nf_bridge_maybe_copy_header into two pieces
Move copy portion out of line.
Use Ethernet header size macros.
Use header file to handle CONFIG_NETFILTER_BRIDGE differences

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV4]: Make struct sockaddr_in::sin_port __be16
Alexey Dobriyan [Tue, 29 Aug 2006 06:58:32 +0000]
[IPV4]: Make struct sockaddr_in::sin_port __be16

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV4]: Make struct in_addr::s_addr __be32
Alexey Dobriyan [Tue, 29 Aug 2006 06:57:56 +0000]
[IPV4]: Make struct in_addr::s_addr __be32

There will be relatively small increase in sparse endian warnings, but
this (and sin_port) patch is a first step to make networking code
endian clean.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER]: xt_CONNMARK.c build fix
Benoit Boissinot [Tue, 29 Aug 2006 00:50:37 +0000]
[NETFILTER]: xt_CONNMARK.c build fix

net/netfilter/xt_CONNMARK.c: In function 'target':
net/netfilter/xt_CONNMARK.c:59: warning: implicit declaration of
function 'nf_conntrack_event_cache'

The warning is due to the following .config:
CONFIG_IP_NF_CONNTRACK=m
CONFIG_IP_NF_CONNTRACK_MARK=y
# CONFIG_IP_NF_CONNTRACK_EVENTS is not set
CONFIG_IP_NF_CONNTRACK_NETLINK=m

This change was introduced by:
http://www.kernel.org/git/?p=linux/kernel/git/davem/net-2.6.19.git;a=commit;h=76e4b41009b8a2e9dd246135cf43c7fe39553aa5

Proposed solution (based on the define in
include/net/netfilter/nf_conntrack_compat.h:

Signed-off-by: Benoit Boissinot <benoit.boissinot@ens-lyon.org>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] ROUTE: Fix dst reference counting in ip6_pol_route_lookup().
YOSHIFUJI Hideaki [Mon, 28 Aug 2006 20:19:30 +0000]
[IPV6] ROUTE: Fix dst reference counting in ip6_pol_route_lookup().

In ip6_pol_route_lookup(), when we finish backtracking at the
top-level root entry, we need to hold it.

Bug noticed by Mitsuru Chinen <CHINEN@jp.ibm.com>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETLINK]: Make use of NLA_STRING/NLA_NUL_STRING attribute validation
Thomas Graf [Sun, 27 Aug 2006 03:13:18 +0000]
[NETLINK]: Make use of NLA_STRING/NLA_NUL_STRING attribute validation

Converts existing NLA_STRING attributes to use the new
validation features, saving a couple of temporary buffers.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETLINK]: Improve string attribute validation
Thomas Graf [Sun, 27 Aug 2006 03:11:47 +0000]
[NETLINK]: Improve string attribute validation

Introduces a new attribute type NLA_NUL_STRING to support NUL
terminated strings. Attributes of this kind require to carry
a terminating NUL within the maximum specified in the policy.

The `old' NLA_STRING which is not required to be NUL terminated
is extended to provide means to specify a maximum length of the
string.

Aims at easing the pain with using nla_strlcpy() on temporary
buffers.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[UDP]: saddr_cmp function should take const socket pointers
David S. Miller [Sun, 27 Aug 2006 03:10:15 +0000]
[UDP]: saddr_cmp function should take const socket pointers

This also kills a warning while building ipv6:

net/ipv6/udp.c: In function ‘udp_v6_get_port’:
net/ipv6/udp.c:66: warning: passing argument 3 of ‘udp_get_port’ from incompatible pointer type

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[UDP]: Mark udp_port_rover static.
David S. Miller [Sun, 27 Aug 2006 03:06:49 +0000]
[UDP]: Mark udp_port_rover static.

It is not referenced outside of net/ipv4/udp.c any longer.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[UDP]: Unify UDPv4 and UDPv6 ->get_port()
Gerrit Renker [Sun, 27 Aug 2006 03:06:05 +0000]
[UDP]: Unify UDPv4 and UDPv6 ->get_port()

This patch creates one common function which is called by
udp_v4_get_port() and udp_v6_get_port(). As a result,
  * duplicated code is removed
  * udp_port_rover and local port lookup can now be removed from udp.h
  * further savings follow since the same function will be used by UDP-Litev4
    and UDP-Litev6

In contrast to the patch sent in response to Yoshifujis comments
(fixed by this variant), the code below also removes the
EXPORT_SYMBOL(udp_port_rover), since udp_port_rover can now remain
local to net/ipv4/udp.c.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER]: Fix nf_conntrack_ftp.c build.
David S. Miller [Sun, 27 Aug 2006 02:48:49 +0000]
[NETFILTER]: Fix nf_conntrack_ftp.c build.

Noticed by Adrian Bunk.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET]: Use SLAB_PANIC
Alexey Dobriyan [Sun, 27 Aug 2006 02:25:52 +0000]
[NET]: Use SLAB_PANIC

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETLINK]: remove third bogus argument from NLA_PUT_FLAG
Johannes Berg [Sun, 27 Aug 2006 02:17:53 +0000]
[NETLINK]: remove third bogus argument from NLA_PUT_FLAG

This patch removes the 'value' argument from NLA_PUT_FLAG which is
unused anyway. The documentation comment was already correct so it
doesn't need an update :)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[DCCP]: Introduce tx buffering
Ian McDonald [Sun, 27 Aug 2006 02:16:45 +0000]
[DCCP]: Introduce tx buffering

This adds transmit buffering to DCCP.

I have tested with CCID2/3 and with loss and rate limiting.

Signed off by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[DCCP]: Shift sysctls into feat.h
Ian McDonald [Sun, 27 Aug 2006 02:15:35 +0000]
[DCCP]: Shift sysctls into feat.h

This shifts further sysctls into feat.h. No change in
functionality - shifting code only.

Signed off by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET]: Use BUILD_BUG_ON() for checking size of skb->cb.
YOSHIFUJI Hideaki [Fri, 1 Sep 2006 07:29:06 +0000]
[NET]: Use BUILD_BUG_ON() for checking size of skb->cb.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6]: Fix routing by fwmark
Patrick McHardy [Sat, 26 Aug 2006 23:50:20 +0000]
[IPV6]: Fix routing by fwmark

Fix mark comparison, also dump the mask to userspace when the mask is
zero, but the mark is not (in which case the mark is dumped, so the
mask is needed to make sense of it).

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[TCP] Congestion control (modulo lp, bic): use BUILD_BUG_ON
Alexey Dobriyan [Sat, 26 Aug 2006 00:10:33 +0000]
[TCP] Congestion control (modulo lp, bic): use BUILD_BUG_ON

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET_SCHED]: Add mask support to fwmark classifier
Patrick McHardy [Fri, 25 Aug 2006 23:11:42 +0000]
[NET_SCHED]: Add mask support to fwmark classifier

Support masking the nfmark value before the search. The mask value is
global for all filters contained in one instance. It can only be set
when a new instance is created, all filters must specify the same mask.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[DECNET]: Add support for fwmark masks in routing rules
Patrick McHardy [Fri, 25 Aug 2006 23:11:08 +0000]
[DECNET]: Add support for fwmark masks in routing rules

Add support for fwmark masks. For compatibility a mask of 0xFFFFFFFF is used
when a mark value != 0 is sent without a mask.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Steven Whitehouse <steve@chygwyn.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV4]: Add support for fwmark masks in routing rules
Patrick McHardy [Fri, 25 Aug 2006 23:10:14 +0000]
[IPV4]: Add support for fwmark masks in routing rules

Add a FRA_FWMASK attributes for fwmark masks. For compatibility a mask of
0xFFFFFFFF is used when a mark value != 0 is sent without a mask.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6]: Fix build with fwmark disabled.
David S. Miller [Fri, 25 Aug 2006 23:07:48 +0000]
[IPV6]: Fix build with fwmark disabled.

Based upon a patch by Brian Haley.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] ROUTE: Add support for fwmask in routing rules.
YOSHIFUJI Hideaki [Fri, 25 Aug 2006 23:05:43 +0000]
[IPV6] ROUTE: Add support for fwmask in routing rules.

Add support for fwmark masks.
A mask of 0xFFFFFFFF is used when a mark value != 0 is sent without a mask.

Based on patch for net/ipv4/fib_rules.c by Patrick McHardy <kaber@trash.net>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] ROUTE: Fix size of fib6_rule_policy.
YOSHIFUJI Hideaki [Fri, 25 Aug 2006 23:05:00 +0000]
[IPV6] ROUTE: Fix size of fib6_rule_policy.

It should not be RTA_MAX+1 but FRA_MAX+1.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] ROUTE: Fix FWMARK support.
YOSHIFUJI Hideaki [Fri, 25 Aug 2006 23:04:29 +0000]
[IPV6] ROUTE: Fix FWMARK support.

- Add missing nla_policy entry.
- type of fwmark is u32, not u8.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Respect priority in policy lookups.
David S. Miller [Fri, 25 Aug 2006 22:46:46 +0000]
[XFRM]: Respect priority in policy lookups.

Even if we find an exact match in the hash table,
we must inspect the inexact list to look for a match
with a better priority.

Noticed by Masahide NAKAMURA <nakam@linux-ipv6.org>.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[TCP] tcp_bic: use BUILD_BUG_ON
Alexey Dobriyan [Fri, 25 Aug 2006 07:38:03 +0000]
[TCP] tcp_bic: use BUILD_BUG_ON

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[TCP] tcp_lp: use BUILD_BUG_ON
Alexey Dobriyan [Fri, 25 Aug 2006 07:37:24 +0000]
[TCP] tcp_lp: use BUILD_BUG_ON

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NET] in6_pton: Kill errant printf statement.
David S. Miller [Fri, 25 Aug 2006 07:27:09 +0000]
[NET] in6_pton: Kill errant printf statement.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[NETFILTER] NF_CONNTRACK_FTP: Use in6_pton() to convert address string.
YOSHIFUJI Hideaki [Sun, 18 Jun 2006 18:20:32 +0000]
[NETFILTER] NF_CONNTRACK_FTP: Use in6_pton() to convert address string.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[NET]: Add common helper functions to convert IPv6/IPv4 address string to network...
YOSHIFUJI Hideaki [Sun, 25 Jun 2006 14:54:55 +0000]
[NET]: Add common helper functions to convert IPv6/IPv4 address string to network address structure.

These helpers can be used in netfilter, cifs etc.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[IPV6] ROUTE: Routing by FWMARK.
YOSHIFUJI Hideaki [Mon, 21 Aug 2006 10:22:01 +0000]
[IPV6] ROUTE: Routing by FWMARK.

Based on patch by Jean Lorchat <lorchat@sfc.wide.ad.jp>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[IPV6] ROUTE: Routing by Traffic Class.
YOSHIFUJI Hideaki [Mon, 21 Aug 2006 10:18:57 +0000]
[IPV6] ROUTE: Routing by Traffic Class.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[IPV6] MIP6: Several obvious clean-ups.
YOSHIFUJI Hideaki [Thu, 24 Aug 2006 14:18:12 +0000]
[IPV6] MIP6: Several obvious clean-ups.

- Remove redundant code.  Pointed out by Brian Haley <brian.haley@hp.com>.
- Unify code paths with/without CONFIG_IPV6_MIP.
- Use NIP6_FMT for IPv6 address textual presentation.
- Fold long line.  Pointed out by David Miller <davem@davemloft.net>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[IPSEC] esp: Defer output IV initialization to first use.
David S. Miller [Fri, 22 Sep 2006 22:17:35 +0000]
[IPSEC] esp: Defer output IV initialization to first use.

First of all, if the xfrm_state only gets used for input
packets this entropy is a complete waste.

Secondly, it is often the case that a configuration loads
many rules (perhaps even dynamically) and they don't all
necessarily ever get used.

This get_random_bytes() call was showing up in the profiles
for xfrm_state inserts which is how I noticed this.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Extract common hashing code into xfrm_hash.[ch]
David S. Miller [Thu, 24 Aug 2006 11:50:50 +0000]
[XFRM]: Extract common hashing code into xfrm_hash.[ch]

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Hash policies when non-prefixed.
David S. Miller [Thu, 24 Aug 2006 11:45:07 +0000]
[XFRM]: Hash policies when non-prefixed.

This idea is from Alexey Kuznetsov.

It is common for policies to be non-prefixed.  And for
that case we can optimize lookups, insert, etc. quite
a bit.

For each direction, we have a dynamically sized policy
hash table for non-prefixed policies.  We also have a
hash table on policy->index.

For prefixed policies, we have a list per-direction which
we will consult on lookups when a non-prefix hashtable
lookup fails.

This still isn't as efficient as I would like it.  There
are four immediate problems:

1) Lots of excessive refcounting, which can be fixed just
   like xfrm_state was
2) We do 2 hash probes on insert, one to look for dups and
   one to allocate a unique policy->index.  Althought I wonder
   how much this matters since xfrm_state inserts do up to
   3 hash probes and that seems to perform fine.
3) xfrm_policy_insert() is very complex because of the priority
   ordering and entry replacement logic.
4) Lots of counter bumping, in addition to policy refcounts,
   in the form of xfrm_policy_count[].  This is merely used
   to let code path(s) know that some IPSEC rules exist.  So
   this count is indexed per-direction, maybe that is overkill.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Hash xfrm_state objects by source address too.
David S. Miller [Thu, 24 Aug 2006 11:00:03 +0000]
[XFRM]: Hash xfrm_state objects by source address too.

The source address is always non-prefixed so we should use
it to help give entropy to the bydst hash.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Kill excessive refcounting of xfrm_state objects.
David S. Miller [Thu, 24 Aug 2006 10:54:22 +0000]
[XFRM]: Kill excessive refcounting of xfrm_state objects.

The refcounting done for timers and hash table insertions
are just wasted cycles.  We can eliminate all of this
refcounting because:

1) The implicit refcount when the xfrm_state object is active
   will always be held while the object is in the hash tables.
   We never kfree() the xfrm_state until long after we've made
   sure that it has been unhashed.

2) Timers are even easier.  Once we mark that x->km.state as
   anything other than XFRM_STATE_VALID (__xfrm_state_delete
   sets it to XFRM_STATE_DEAD), any timer that fires will
   do nothing and return without rearming the timer.

   Therefore we can defer the del_timer calls until when the
   object is about to be freed up during GC.  We have to use
   del_timer_sync() and defer it to GC because we can't do
   a del_timer_sync() while holding x->lock which all callers
   of __xfrm_state_delete hold.

This makes SA changes even more light-weight.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Purge dst references to deleted SAs passively.
David S. Miller [Thu, 24 Aug 2006 10:30:28 +0000]
[XFRM]: Purge dst references to deleted SAs passively.

Just let GC and other normal mechanisms take care of getting
rid of DST cache references to deleted xfrm_state objects
instead of walking all the policy bundles.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Do not flush all bundles on SA insert.
David S. Miller [Thu, 24 Aug 2006 10:29:04 +0000]
[XFRM]: Do not flush all bundles on SA insert.

Instead, simply set all potentially aliasing existing xfrm_state
objects to have the current generation counter value.

This will make routes get relooked up the next time an existing
route mentioning these aliased xfrm_state objects gets used,
via xfrm_dst_check().

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Simplify xfrm_spi_hash
David S. Miller [Thu, 24 Aug 2006 10:26:44 +0000]
[XFRM]: Simplify xfrm_spi_hash

It can use __xfrm{4,6}_addr_hash().

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Put more keys into destination hash function.
David S. Miller [Thu, 24 Aug 2006 10:24:33 +0000]
[XFRM]: Put more keys into destination hash function.

Besides the daddr, key the hash on family and reqid too.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Add generation count to xfrm_state and xfrm_dst.
David S. Miller [Thu, 24 Aug 2006 10:18:09 +0000]
[XFRM]: Add generation count to xfrm_state and xfrm_dst.

Each xfrm_state inserted gets a new generation counter
value.  When a bundle is created, the xfrm_dst objects
get the current generation counter of the xfrm_state
they will attach to at dst->xfrm.

xfrm_bundle_ok() will return false if it sees an
xfrm_dst with a generation count different from the
generation count of the xfrm_state that dst points to.

This provides a facility by which to passively and
cheaply invalidate cached IPSEC routes during SA
database changes.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Dynamic xfrm_state hash table sizing.
David S. Miller [Thu, 24 Aug 2006 10:08:07 +0000]
[XFRM]: Dynamic xfrm_state hash table sizing.

The grow algorithm is simple, we grow if:

1) we see a hash chain collision at insert, and
2) we haven't hit the hash size limit (currently 1*1024*1024 slots), and
3) the number of xfrm_state objects is > the current hash mask

All of this needs some tweaking.

Remove __initdata from "hashdist" so we can use it safely at run time.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Convert xfrm_state hash linkage to hlists.
David S. Miller [Thu, 24 Aug 2006 09:45:07 +0000]
[XFRM]: Convert xfrm_state hash linkage to hlists.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Pull xfrm_state_by{spi,src} hash table knowledge out of afinfo.
David S. Miller [Thu, 24 Aug 2006 07:42:45 +0000]
[XFRM]: Pull xfrm_state_by{spi,src} hash table knowledge out of afinfo.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Pull xfrm_state_bydst hash table knowledge out of afinfo.
David S. Miller [Thu, 24 Aug 2006 07:13:10 +0000]
[XFRM]: Pull xfrm_state_bydst hash table knowledge out of afinfo.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:54:07 +0000]
[XFRM] IPV6: Support Mobile IPv6 extension headers sorting.

Support Mobile IPv6 extension headers sorting for two transformation policies.
Mobile IPv6 extension headers should be placed after IPsec
transport mode, but before transport AH when outbound.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] IPV6: Add sort functions to combine templates/states for IPsec.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:51:02 +0000]
[XFRM] IPV6: Add sort functions to combine templates/states for IPsec.

Add sort functions to combine templates/states for IPsec.
Think of outbound transformation order we should be careful with transport AH
which must be the last of all transport ones.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] POLICY: Support netlink socket interface for sub policy.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:49:28 +0000]
[XFRM] POLICY: Support netlink socket interface for sub policy.

Sub policy can be used through netlink socket.
PF_KEY uses main only and it is TODO to support sub.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Add sorting interface for state and template.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:48:31 +0000]
[XFRM]: Add sorting interface for state and template.

Under two transformation policies it is required to merge them.
This is a platform to sort state for outbound and templates
for inbound respectively.
It will be used when Mobile IPv6 and IPsec are used at the same time.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] POLICY: sub policy support.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:43:30 +0000]
[XFRM] POLICY: sub policy support.

Sub policy is introduced. Main and sub policy are applied the same flow.
(Policy that current kernel uses is named as main.)
It is required another transformation policy management to keep IPsec
and Mobile IPv6 lives separate.
Policy which lives shorter time in kernel should be a sub i.e. normally
main is for IPsec and sub is for Mobile IPv6.
(Such usage as two IPsec policies on different database can be used, too.)

Limitation or TODOs:
 - Sub policy is not supported for per socket one (it is always inserted as main).
 - Current kernel makes cached outbound with flowi to skip searching database.
   However this patch makes it disabled only when "two policies are used and
   the first matched one is bypass case" because neither flowi nor bundle
   information knows about transformation template size.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[XFRM] POLICY: Add Kconfig to support sub policy.
Masahide NAKAMURA [Thu, 24 Aug 2006 05:38:14 +0000]
[XFRM] POLICY: Add Kconfig to support sub policy.

Add Kconfig to support sub policy.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Ignore to report if mobility headers is rejected.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:47:44 +0000]
[IPV6] MIP6: Ignore to report if mobility headers is rejected.

Ignore to report user-space for known mobility headers rejected by
destination options header transformation.
Mobile IPv6 specification (RFC3775) says that mobility header
is used with destination options header carrying home address option
only for binding update message. Other type message cannot be used
and node must drop it silently (and must not send binding error) if
receving such packet.
To achieve it, (1) application should use transformation policy and
wild-card states to catch binding update message prior other packets
(2) kernel doesn't report the reject to user-space not to send
binding error message by application.
This patch is for (2).
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Report to user-space when home address option is rejected.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:45:55 +0000]
[IPV6] MIP6: Report to user-space when home address option is rejected.

Report to user-space when home address option is rejected.
In receiving this message user-space application will send Mobile IPv6 binding
error. It is rate-limited by kernel.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Introduce XFRM_MSG_REPORT.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:44:06 +0000]
[XFRM]: Introduce XFRM_MSG_REPORT.

XFRM_MSG_REPORT is a message as notification of state protocol and
selector from kernel to user-space.

Mobile IPv6 will use it when inbound reject is occurred at route
optimization to make user-space know a binding error requirement.

Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM]: Trace which secpath state is reject factor.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:41:00 +0000]
[XFRM]: Trace which secpath state is reject factor.

For Mobile IPv6 usage, it is required to trace which secpath state is
reject factor in order to notify it to user space (to know the address
which cannot be used route optimized communication).

Based on MIPL2 kernel patch.

This patch was also written by: Henrik Petander <petander@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Transformation support mobility header.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:39:03 +0000]
[IPV6] MIP6: Transformation support mobility header.

Transformation support mobility header.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add sending mobility header functions through raw socket.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:36:47 +0000]
[IPV6] MIP6: Add sending mobility header functions through raw socket.

Mobility header is built by user-space and sent through raw socket.
Kernel just extracts its type to flow.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add receiving mobility header functions through raw socket.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:35:31 +0000]
[IPV6] MIP6: Add receiving mobility header functions through raw socket.

Like ICMPv6, mobility header is handled through raw socket.
In inbound case, check only whether ICMPv6 error should be sent as a reply
or not by kernel.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>
This patch was also written by: Antti Tuominen <anttit@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add Mobility header definition.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:34:26 +0000]
[IPV6] MIP6: Add Mobility header definition.

Add Mobility header definition for Mobile IPv6.
Based on MIPL2 kernel patch.

This patch was also written by: Antti Tuominen <anttit@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] STATE: Add Mobile IPv6 route optimization protocols to netlink interface.
Masahide NAKAMURA [Thu, 24 Aug 2006 03:33:28 +0000]
[XFRM] STATE: Add Mobile IPv6 route optimization protocols to netlink interface.

Add Mobile IPv6 route optimization protocols to netlink interface.
Route optimization states carry care-of address.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add destination options header transformation.
Noriaki TAKAMIYA [Thu, 24 Aug 2006 03:32:34 +0000]
[IPV6] MIP6: Add destination options header transformation.

Add destination options header transformation for Mobile IPv6.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add routing header type 2 transformation.
Noriaki TAKAMIYA [Thu, 24 Aug 2006 03:31:11 +0000]
[IPV6] MIP6: Add routing header type 2 transformation.

Add routing header type 2 transformation for Mobile IPv6.
Based on MIPL2 kernel patch.

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] IPSEC: Support sending with Mobile IPv6 extension headers.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:29:47 +0000]
[IPV6] IPSEC: Support sending with Mobile IPv6 extension headers.

Mobile IPv6 defines home address option as an option of destination
options header. It is placed before fragment header then
ip6_find_1stfragopt() is fixed to know about it.

Home address option also carries final source address of the flow,
then outbound AH calculation should take care of it like routing
header case.  Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Revert address to send ICMPv6 error.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:27:25 +0000]
[IPV6] MIP6: Revert address to send ICMPv6 error.

IPv6 source address is replaced in receiving packet
with home address option carried by destination options header.
To send ICMPv6 error back, original address which is received one on wire
should be used. This function checks such header is included
and reverts them.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6]: Put dsthao after flags in order to pack inet6_skb_parm better.
David S. Miller [Thu, 24 Aug 2006 02:25:55 +0000]
[IPV6]: Put dsthao after flags in order to pack inet6_skb_parm better.

Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add inbound interface of home address option.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:24:48 +0000]
[IPV6] MIP6: Add inbound interface of home address option.

Add inbound function of home address option by registering it to TLV
table for destination options header.

Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add home address option definition.
Noriaki TAKAMIYA [Thu, 24 Aug 2006 02:21:34 +0000]
[IPV6] MIP6: Add home address option definition.

Add home address option definition for Mobile IPv6.
Based on MIPL2 kernel patch.

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6]: Allow to replace skbuff by TLV parser.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:19:50 +0000]
[IPV6]: Allow to replace skbuff by TLV parser.

In receiving Mobile IPv6 home address option which is a TLV carried by
destination options header, kernel will try to mangle source adderss
of packet. Think of cloned skbuff it is required to replace it by the
parser just like routing header case.

This is a framework to achieve that to allow TLV parser to replace
inbound skbuff pointer.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6]: Find option offset by type.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:18:35 +0000]
[IPV6]: Find option offset by type.

This is a helper to search option offset from extension header which
can carry TLV option like destination options header.

Mobile IPv6 home address option will use it.

Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add socket option and ancillary data interface of routing header type 2.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:17:12 +0000]
[IPV6] MIP6: Add socket option and ancillary data interface of routing header type 2.

Add socket option and ancillary data interface of routing header type
2.  Mobile IPv6 application will use this to send binding
acknowledgement with the header without relation of confirmed route
optimization (binding).

Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add inbound interface of routing header type 2.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:16:22 +0000]
[IPV6] MIP6: Add inbound interface of routing header type 2.

Add inbound interface of routing header type 2 for Mobile IPv6.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala <vnuorval@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[IPV6] MIP6: Add routing header type 2 definition.
Noriaki TAKAMIYA [Thu, 24 Aug 2006 02:15:07 +0000]
[IPV6] MIP6: Add routing header type 2 definition.

Add routing header type 2 definition for Mobile IPv6.
Based on MIPL2 kernel patch.

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[IPV6]: Add Kconfig to enable Mobile IPv6.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:13:46 +0000]
[IPV6]: Add Kconfig to enable Mobile IPv6.

Add Kconfig to enable Mobile IPv6.
Based on MIPL2 kernel patch.

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[XFRM]: Fix message about transformation user interface.
Masahide NAKAMURA [Thu, 24 Aug 2006 02:12:56 +0000]
[XFRM]: Fix message about transformation user interface.

Transformation user interface is not only for IPsec.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] IPV6: Restrict bundle reusing
Masahide NAKAMURA [Thu, 24 Aug 2006 02:12:01 +0000]
[XFRM] IPV6: Restrict bundle reusing

For outbound transformation, bundle is checked whether it is
suitable for current flow to be reused or not. In such IPv6 case
as below, transformation may apply incorrect bundle for the flow instead
of creating another bundle:

- The policy selector has destination prefix length < 128
  (Two or more addresses can be matched it)
- Its bundle holds dst entry of default route whose prefix length < 128
  (Previous traffic was used such route as next hop)
- The policy and the bundle were used a transport mode state and
  this time flow address is not matched the bundled state.

This issue is found by Mobile IPv6 usage to protect mobility signaling
by IPsec, but it is not a Mobile IPv6 specific.
This patch adds strict check to xfrm_bundle_ok() for each
state mode and address when prefix length is less than 128.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] IPV6: Update outbound state timestamp for each sending.
Masahide NAKAMURA [Thu, 24 Aug 2006 01:20:16 +0000]
[XFRM] IPV6: Update outbound state timestamp for each sending.

With this patch transformation state is updated last used time
for each sending. Xtime is used for it like other state lifetime
expiration.
Mobile IPv6 enabled nodes will want to know traffic status of each
binding (e.g. judgement to request binding refresh by correspondent node,
or to keep home/care-of nonce alive by mobile node).
The last used timestamp is an important hint about it.
Based on MIPL2 kernel patch.

This patch was also written by: Henrik Petander <petander@tcs.hut.fi>

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] STATE: Introduce care-of address.
Noriaki TAKAMIYA [Thu, 24 Aug 2006 01:18:55 +0000]
[XFRM] STATE: Introduce care-of address.

Care-of address is carried by state as a transformation option like
IPsec encryption/authentication algorithm.

Based on MIPL2 kernel patch.

Signed-off-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

13 years ago[XFRM] STATE: Support non-fragment outbound transformation headers.
Masahide NAKAMURA [Thu, 24 Aug 2006 01:11:50 +0000]
[XFRM] STATE: Support non-fragment outbound transformation headers.

For originated outbound IPv6 packets which will fragment, ip6_append_data()
should know length of extension headers before sending them and
the length is carried by dst_entry.
IPv6 IPsec headers fragment then transformation was
designed to place all headers after fragment header.
OTOH Mobile IPv6 extension headers do not fragment then
it is a good idea to make dst_entry have non-fragment length to tell it
to ip6_append_data().

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

13 years ago[XFRM] STATE: Add a hook to obtain local/remote outbound address.
Masahide NAKAMURA [Thu, 24 Aug 2006 01:10:33 +0000]
[XFRM] STATE: Add a hook to obtain local/remote outbound address.

Outbound transformation replaces both source and destination address with
state's end-point addresses at the same time when IPsec tunnel mode.
It is also required to change them for Mobile IPv6 route optimization, but we
should care about the following differences:
 - changing result is not end-point but care-of address
 - either source or destination is replaced for each state
This hook is a common platform to change outbound address.
Based on MIPL2 kernel patch.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>